Wikipedia:Sockpuppet investigations/Dyhp612/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility


 * Similar usernames: "2017" as suffix, "Dx" + two letters + 2 numbers + 1


 * Implausible overlaps. For instance, see Romania at major beauty pageants, created by the alleged master. Olaf2017 and Greatbritain2017 both removed the AFD tag: . Dxow981, Dxdc621, and UnitopPH all overlap on Template:Countries at major beauty pageants, while Greatbritain2017 and NuestraBelleza2017 overlap on Template:Miss Universe 2017 delegates.


 * Similar page creations and interests. NuestraBelleza2017 and Greatbritain2017 both created articles on Miss Universe 2017 delegates, Alisson Abarca and Anna Burdzy. Dxdc621, UnitopPH, and Dxow981 have all created pages in the format "[Country] at major beauty pageants." GABgab 00:41, 17 July 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Self-endorsing my own request. Thanks, GABgab 00:41, 17 July 2017 (UTC)
 * Nice catch. Two groups, to each other based on ISP, UA, and geolocation.
 * Group 1:


 * Group 2:


 * Blocked without tags. I think Dyhp612 is the oldest account; please verify, tag and move the SPI accordingly. Thanks. :-) Katietalk 11:22, 17 July 2017 (UTC)
 * ✅. GABgab 22:24, 17 July 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Similar usernames and similar interest in beauty pageants. Rentier (talk) 17:37, 2 August 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Please compare to previous socks and check for others. Thanks, GABgab 22:31, 2 August 2017 (UTC)
 * to group 2 in the archived case. Courcelles (talk) 21:56, 3 August 2017 (UTC)
 * Good enough for me, . GABgab 23:36, 3 August 2017 (UTC)

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

Please see sample article history: strong overlap with Special:Contributions/Taurus2017 (both on 19 Nov) and Special:Contributions/Radioph (both on 10 Aug). Taurus was discussed as connected to Dyhp612 here: User_talk:Taurus2017; Radioph was confirmed to Taurus. Same topic area for the tree accounts: beauty pageants; please see comparison between Radioph and Medianadia and between Taurus2017 and Medianadia. K.e.coffman (talk) 02:08, 27 November 2017 (UTC)
 * Added Ndgdtw due to the overlap in the same topic area, specifically in Veruska Ljubisavljevic. Also adding Hpcidaniello due to the same concerns. K.e.coffman (talk) 02:49, 27 November 2017 (UTC)
 * Medianadia deleted a Speedy deletion tag from an article developed by Taurus2017: . There have been no edits by other on the article. K.e.coffman (talk) 03:22, 28 November 2017 (UTC)


 * Behavioural evidence for a connection between AnnLivinova sock farm and Medianadia: I randomly clicked on one of the socks from the investigation, Special:Contributions/Torrie1975, and I find that their edits are very similar in nature – mostly gnomish edits relating to updates of pageant results. These two edits are identical:


 * by Medianadia: Quezada represented Nicaragua at Miss Universe 2017 but Unplaced.


 * by Torrie1975: “As the winner of Miss Universe Serbia, Radosavljević represented Serbia at Miss Universe 2015 pageant but Unplaced.”


 * Notice “but Unplaced” in both cases – it’s grammatically incorrect, also with the strange capitalization of “Unplaced”. I believe these two accounts to belong to the same editor. K.e.coffman (talk) 00:09, 1 December 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * I'm converting this to a CU request so that a clerk can review to see if it is warranted. Given the previous amount of sleepers, and the behavioral connection to another farm, it probably would be useful. TonyBallioni (talk) 19:18, 28 November 2017 (UTC)
 * The three listed suspected puppets here are ❌ to each other and to the four accounts blocked by on User Talk:Taurus2017.
 * Based on technical and behavioral evidence, Medianadia is to at least one of the archived socks at Sockpuppet investigations/AnnLivinova. However, before deciding whether to block, I'd appreciate a deeper behavioral analysis.--Bbb23 (talk) 21:24, 29 November 2017 (UTC)
 * Medianadia . Closing. GABgab 15:40, 28 December 2017 (UTC)

Suspected sockpuppets
New additions


 * User compare report Auto-generated every hour.
 * Editor interaction utility

A newly created account with a focus on beauty pageants, similar to Special:Contributions/Taurus2017 and Special:Contributions/Radioph. The account name is peculiar: Frøken Norge is Norwegian name of Miss Norway, but the first edits are to Vietnamese pageants and pageant winners. Same as Taurus and Radio, FrøkenNorge uses "Mobile edit, Mobile web edit".

This article's history contains edits by all three accounts:. Frøken Norge created a number redirects from names of pageant winners to pageants: sample; if memory serves me right, Radioph / Taurus also created redirects. The redirect linked is for the subject whose article has been recently deleted as G5, so it seems unusual that FrøkenNorge would pick two of the creations by Radioph / Taurus to create redirects. Here's another example of same:. K.e.coffman (talk) 00:52, 11 January 2018 (UTC)
 * Also adding Special:Contributions/Universo2008 due to similar concerns. This account is a bit older (created in early Dec 2017), but exhibit similar pattern of editing -- laser-focused on beauty pageants, while also using "Mobile edit, Mobile web edit". Similar to FrøkenNorge, the first edit was to sandbox. Special:Contributions/Shakira2017 & Special:Contributions/Nguyenquochieu2107 have a similar editing pattern, so adding them as well. K.e.coffman (talk) 05:59, 11 January 2018 (UTC)
 * Update: I added Special:Contributions/Jourdan Ann and Special:Contributions/Sasha Boudville.  They exhibit similar style as Frøken Norge / Radioph / Taurus: same topic area; no edit summaries; "Mobile web edit". K.e.coffman (talk) 02:19, 13 January 2018 (UTC)

Behavioral evidence

I ran user interaction reports on the new additions. What's interesting is that there's some overlap between Medianadia (a sock of AnnLivinova) and the Jourdan Ann account:. There's overlap between Jourdan Ann and Sasha Boudville:. I'm not sure if this information is meaningful; socks are perhaps so entrenched in the beauty pageant area that they would inevitably edit the same pages if given enough time. K.e.coffman (talk) 06:12, 13 January 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Nguyenquochieu2107 is ❌.
 * is on a different device but there is a little bit of range crossover making them to the above.
 * Nguyenquochieu2107 is ❌.
 * is on a different device but there is a little bit of range crossover making them to the above.
 * Nguyenquochieu2107 is ❌.
 * is on a different device but there is a little bit of range crossover making them to the above.
 * Nguyenquochieu2107 is ❌.
 * is on a different device but there is a little bit of range crossover making them to the above.

— Berean Hunter   (talk)  13:20, 11 January 2018 (UTC)
 * I was unable to technically connect the confirmed accounts above to the socks in the archive.

— Berean Hunter   (talk)  13:39, 11 January 2018 (UTC)
 * I should add that although I could not match them, they are in the same country using similar ranges as the accounts in the archive. I can't see the UAs for the two groups in July's report because they are stale.

— Berean Hunter   (talk)  02:36, 13 January 2018 (UTC)
 * and are ❌ to the confirmed socks above as they are editing from a different country, however they are both in the same country and are  meatpuppets or socks to each other.
 * I'm not really seeing any concrete link between the three remaining accounts and the master, beyond simply a shared interest in beauty pageants. That's not enough to confirm sockpuppetry. Closing without further action. Sir Sputnik (talk) 23:14, 5 February 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

I notice his edits in Tara De Vries are same, and his name end in 2018. FPP (talk) 07:56, 30 October 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
✅ + . . Please move case to Dzbb594.--Bbb23 (talk) 14:36, 1 November 2018 (UTC)
 * - In order to facilitate and expedite your request, please provide diffs to support your case. Please give two or more diffs meeting the following format:
 * 1) At least one diff is from the sockmaster (or an account already blocked as a confirmed sockpuppet of the sockmaster), showing the behaviour characteristic of the sockmaster.
 * 2) At least one diff per suspected sockpuppet, showing the suspected sockpuppet emulating the behaviour of the sockmaster given in the first diff.
 * 3) In situations where it is not immediately obvious from the diffs what the characteristic behaviour is, a short explanation must be provided. Around one sentence is enough for this.  Vanjagenije   (talk)  09:50, 1 November 2018 (UTC)
 * ✅. Sir Sputnik (talk) 19:05, 1 November 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Ridiculously loud duck. See Vania Herlambang and specifically there is also significant xover with another master,  in terms of topic and naming similarities so the cases may be related. Praxidicae (talk) 10:13, 10 November 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Already blocked. Sir Sputnik (talk) 14:56, 10 November 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

he made same edits in Tara De Vries article --FPP (talk) 07:14, 17 November 2018 (UTC) FPP (talk) 07:14, 17 November 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - The edits to Tara De Vries are suspicious given the timing and choice of username, but fairly generic. Please check to confirm. Sir Sputnik (talk) 15:00, 17 November 2018 (UTC)
 * ✅ plus:
 * TheEmotion2018 was behaviorally blocked as a suspected sock in Sockpuppet investigations/Dyhp612. If the behavior in the older case matches this one – and I suspect it does – this case should be merged into that case with appropriate retagging. I've blocked the three unblocked accounts without tags.--Bbb23 (talk) 16:31, 17 November 2018 (UTC)
 * This looks pretty clear cut to me too. Case merged, tagging and closing. Sir Sputnik (talk) 20:17, 17 November 2018 (UTC)
 * TheEmotion2018 was behaviorally blocked as a suspected sock in Sockpuppet investigations/Dyhp612. If the behavior in the older case matches this one – and I suspect it does – this case should be merged into that case with appropriate retagging. I've blocked the three unblocked accounts without tags.--Bbb23 (talk) 16:31, 17 November 2018 (UTC)
 * This looks pretty clear cut to me too. Case merged, tagging and closing. Sir Sputnik (talk) 20:17, 17 November 2018 (UTC)
 * This looks pretty clear cut to me too. Case merged, tagging and closing. Sir Sputnik (talk) 20:17, 17 November 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

same edits in Tara De Vries article FPP (talk) 12:43, 26 November 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
Please move to correct case.--Bbb23 (talk) 16:05, 26 November 2018 (UTC)
 * ✅. Sir Sputnik (talk) 20:07, 27 November 2018 (UTC)
 * ✅ + . Blocked, tagged, closing.--Bbb23 (talk) 02:00, 28 November 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

A month old user with a focus on beauty pageants. The suspected sock was registered two weeks after was blocked and recreated their deleted articles Fernanda Alves (model) (Fernanda Alves (Miss International)) and Erica De Matteis. GSS (talk |c|em ) 11:50, 18 January 2019 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Appears worth a CU check. Not stale. The SandDoctor  Talk 14:02, 25 January 2019 (UTC)
 * - For confirmation + sleepers. Please also check, per overlap. Thanks, GABgab 18:36, 25 January 2019 (UTC)
 * Both ✅ along with a lot of logged-out editing. —DoRD (talk)​ 18:56, 25 January 2019 (UTC)
 * , will check for anything G5'able. GABgab 18:59, 25 January 2019 (UTC)
 * Is it okay to mark this as 'close'd now? -- The SandDoctor Talk 01:52, 26 January 2019 (UTC)


 * G5'd stuff, closing. GABgab 11:29, 26 January 2019 (UTC)

Suspected sockpuppets

 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Requesting that Sockpuppet investigations/RadyoUkay819 be folded into this SPI. Another editor noted when opening the Dyhp612 case 17 July 2017: Similar usernames: "2017" as suffix, "Dx" + two letters + 2 numbers + 1. RadyoUkay819 appears to be likely the same master, with CU confirmed socks User:Dxic711, User:Dxma929, User:Dxoc1494 following that convention or nearly so. Other behavioral evidence is a match as well. ☆ Bri (talk) 17:05, 11 September 2020 (UTC)
 * Pls consider newly discovered sock User:Dyth990, looks like similar or same naming formula. ☆ Bri (talk) 01:41, 22 September 2020 (UTC)
 * I don't know if this has been pointed out before:
 * RU819 <---> Dyhp612 behavioral matches include the blockquote construction of userpages e.g.:, vs ,.
 * They also have the right amount of (non) overlap to be consistent with (non) linkage via CU technical evidence; see graphical representation at WP:COIN.
 * It was suggested earlier in the investigation that one of the accounts was associated with logged-out editing. Of course I'm not privy to the same things CU saw, but I think that I have seen some similar PLDT use between the two that might point in the right direction.
 * ☆ Bri (talk) 01:34, 29 September 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * , you mentioned the possible connection between these two cases a month ago, under the RadyoUkay819 case (01 September 2020). Is there any evidence beyond what was available then?  FWIW, I did a little digging.  Here's the users with the common naming pattern in the two cases:


 * RadyoUkay819:Dxoc1494
 * RadyoUkay819:Dxic711
 * RadyoUkay819:Dxil1031
 * RadyoUkay819:Dycm1152
 * RadyoUkay819:Dxma929
 * Dyhp612:Dyhp612
 * Dyhp612:Dxrr1017
 * Dyhp612:Dxum819
 * Dyhp612:Dyrb540
 * Dyhp612:Dxow981
 * Dyhp612:Dxdc621
 * Dyhp612:Dzbb594

It looks like the only one that's not stale is Dxma929, so other than the obvious similarity in user names, there's really not much to go on. Theres's no doubt this is a huge pile of spammy socky UPE, but I'm not sure what value there is in investing a huge amount of effort to figure out if these are really the same farm as each other. -- RoySmith (talk) 00:11, 28 September 2020 (UTC)
 * and closed. Confirmed socks in both cases each have a consistent geolocation, and those locations are on different continents. They're probably working together based on the username evidence, but they are different users. Ivanvector (Talk/Edits) 14:54, 7 October 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same ISP, very close to 2001:4455:42F:F200:A504:BF36:56D4:DA45 just recently CU blocked by for same sort of editing on beauty pageant articles. These articles have been plagued by socks and logged-out socks as described at conflict of interest noticeboard and WP:AN. Note that IPs first edit directly follows RadyoUkay819 sock ; I can't reliably tell the two sockfarms apart. Bri.public (talk) 22:54, 1 October 2020 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Closing; the IP is already blocked, and checkusers will not connect an IP to a named case. we have pretty good private notes on which IPs are associated with which of the beauty pageant sockfarms, but the privacy policy forbids us from disclosing those connections publicly, so there's not much we can actually do with IP reports in these cases. Since they're all behaviourally similar, I think that reporting IPs here is only serving to confuse the clerks. Can I suggest if you see an IP sock similar to one of these cases, you email a checkuser (you can email me), and/or make a request at WP:RFPP to apply WP:GS/PAGEANT sanctions? Ivanvector (Talk/Edits) 15:05, 7 October 2020 (UTC)

Suspected sockpuppets

 * ( originally filed under this user)


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

A new disruptive beauty pageant SPA with signs of WP:DUCKage: no edit summaries, mobile edits only, camelcase name (note four CU-confirmed socks at Category:Wikipedia_sockpuppets_of_DevilBlack69 named MissXxxx). It could be RadyoUkay819 as easily, I can't tell them apart. - Bri.public (talk) 15:57, 6 October 2020 (UTC)
 * They appeared at Miss Earth 2020 a few days after a logged-out block evader 95.39.235.87
 * Directly followed a block evader 95.39.211.22 at Miss Earth Thailand
 * Directly followed CU-confirmed RadyoUkay sock at Miss Earth China, exactly repeating their reverted edit

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * This is technically ❌ but I'd take that with a grain of salt so . Callanecc (talk • contribs • logs) 22:54, 6 October 2020 (UTC)
 * I double-checked against some of the other known beauty pageant sockfarms. Logs show this account is located in the same small country as confirmed Sockpuppet investigations/Dyhp612 socks. There are no non-stale socks to check in that case so the best I can do is . Behavioural analysis against that case may yield better conclusions. Ivanvector (Talk/Edits) 15:07, 7 October 2020 (UTC)
 * I see similarities with the lack of edit summaries, the use of mobile web and changing of pageant titles. This isn't enough to flag it as this sockmaster, but enough to block it as someone's sock. I moved the case here simply out of likelihood from the technical data Ivan mentions. -- Amanda  (aka DQ) 18:32, 27 October 2020 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.


 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Primarily based on beauty pageant SPA history and the account naming convention this sockfarm has been known to use ( for one, fuller list at WP:Sockpuppet investigations/Dyhp612/Archive).

These two accounts are the only two other than me editing Maristella Okpala, when I noticed them. ☆ Bri (talk) 22:07, 26 September 2021 (UTC) ☆ Bri (talk) 22:10, 26 September 2021 (UTC)

Added PLDT IP address that looks like same person logged-out editing on Maristella Okpala several times, e.g. here a few minutes after dxcm and here a few minutes after dxds. ☆ Bri (talk) 22:42, 26 September 2021 (UTC)

Another likely logged-out IP in range edited two minutes after dxds here and one minute after here, just after a four-minute interaction between the named accounts here.

Another IP in range one minute after dxds here and another 5 minutes after dxcm here. ☆ Bri (talk) 03:38, 27 September 2021 (UTC)

Added new named user Vermont helper, also pageant SPA, on the early edit history Miss Supranational 2022, especially as little as 1 minute interval with IP in PLDT range like this.

Both named accounts took identical actions as their first two edits on enwp:
 * 1) Add project templates (erroneously) to user talkpage:
 * 2) Add identically formatted pageant contestant quip to user page:

☆ Bri (talk) 05:00, 27 September 2021 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * There are an awful lot of IP accounts that helped the sockpuppets build up a couple of dozen articles on beauty pageant contestants besides those listed here. Is a range-block possible or would that be ineffective? Liz Read! Talk! 21:04, 27 September 2021 (UTC)
 * Please notify me, ideally on my talk page, when this case is closed. I'd like to protect all pageant-related pages edited using the IP addresses per WP:GS/PAGEANT if they're found to be sockpuppets. Thank you very much in advance. ~ ToBeFree (talk) 22:13, 5 October 2021 (UTC)
 * @ToBeFree I don't see anthing else to do here, so I'll close this. A lot of this is coming from 49.146.32.0/20, but it also looks like there's a lot of legitimate editing on that range. -- RoySmith (talk) 22:34, 5 October 2021 (UTC)
 * Hm, okay. I was referring to "Behavioural evidence needs evaluation for the IP addresses"; in this specific case, even if they're not editing anymore, a "yes, sockpuppet" or "no sockpuppet" would have a pretty severe effect. ~ ToBeFree (talk) 22:36, 5 October 2021 (UTC)
 * Well, I think the best I can tell you is that it looks like a lot of the traffic on 49.146.32.0/20 is related to this sock, but there's enough that looks like it's not that I'm not comfortable blocking. If you want to semi-protect various pages, that might be a reasonable thing to do. -- RoySmith (talk) 22:39, 5 October 2021 (UTC)
 * All right, thank you very much. Face-smile.svg ~ ToBeFree (talk) 22:40, 5 October 2021 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Dxcm1089 and Dxds1161 are ✅ to each other, and while the case is stale it's pretty obvious they're the same user as Dyhp612. . Vermont helper is ❌. for the IP addresses. Ivanvector (Talk/Edits) 16:31, 27 September 2021 (UTC)
 * Blocked 49.149.138.0 for a month. As noted above, 49.146.32.0/20 looks like it has a lot of legitimate editing, so not going to do anything there.  Closing. -- RoySmith (talk) 22:36, 5 October 2021 (UTC)